Skip to content

Commit b32e55d

Browse files
authored
workflows/release-binaries: Stop using ccache (llvm#124415)
Using ccache relies on the GitHub Actions Cache, which may be susceptible to cache poisoning. See https://adnanthekhan.com/2024/05/06/the-monsters-in-your-build-cache-github-actions-cache-poisoning/ Even though these attacks may be difficult, it's better to err on the side of caution and ensure that the build environment for our releases is as isolated as possible. Additionally, ccache was only being used for the stage1 build, which is a small part of the overall build, so the speed up from using it was not that large.
1 parent cdc09a1 commit b32e55d

File tree

1 file changed

+2
-11
lines changed

1 file changed

+2
-11
lines changed

.github/workflows/release-binaries.yml

Lines changed: 2 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -226,14 +226,6 @@ jobs:
226226
id: setup-stage
227227
uses: ./workflows-main/.github/workflows/release-binaries-setup-stage
228228

229-
- name: Setup sccache
230-
uses: hendrikmuhs/ccache-action@ca3acd2731eef11f1572ccb126356c2f9298d35e # v1.2.9
231-
with:
232-
# Default to 2G to workaround: https://github.com/hendrikmuhs/ccache-action/issues/174
233-
max-size: 2G
234-
key: ${{ needs.prepare.outputs.ccache }}-${{ runner.os }}-${{ runner.arch }}-release
235-
variant: ${{ needs.prepare.outputs.ccache }}
236-
237229
- name: Configure
238230
id: build
239231
shell: bash
@@ -246,9 +238,8 @@ jobs:
246238
${{ needs.prepare.outputs.target-cmake-flags }} \
247239
-C clang/cmake/caches/Release.cmake \
248240
-DBOOTSTRAP_LLVM_PARALLEL_LINK_JOBS=1 \
249-
-DBOOTSTRAP_CPACK_PACKAGE_FILE_NAME="${{ needs.prepare.outputs.release-binary-basename }}" \
250-
-DCMAKE_C_COMPILER_LAUNCHER=$CCACHE_BIN \
251-
-DCMAKE_CXX_COMPILER_LAUNCHER=$CCACHE_BIN
241+
-DBOOTSTRAP_CPACK_PACKAGE_FILE_NAME="${{ needs.prepare.outputs.release-binary-basename }}"
242+
252243
- name: Build
253244
shell: bash
254245
run: |

0 commit comments

Comments
 (0)